rel 5; mount /run as mode=0755,noexec,nosuid,nodev (security issue).

[packages/rc-scripts.git] / rc-scripts-git.patch

diff --git a/rc-scripts-git.patch b/rc-scripts-git.patch
index a4338572b75498429be1e309c2e6dee93b40d93b..c16153b3b7b3911922612eb1634d84bb60e2d607 100644 (file)
--- a/rc-scripts-git.patch
+++ b/rc-scripts-git.patch
@@ -1,36 +1,60 @@
-commit f60ef786cf271e20da75988326a8c0cf90a7c485
+diff --git a/lib/functions b/lib/functions
+index 8d018f7..f9538d2 100644
+--- a/lib/functions
++++ b/lib/functions
+@@ -690,13 +690,12 @@ _daemon_exec() {
+                       --exec "$prog" \
+                       -- "$@"
+       else
+-
+-              if [ "$makepid" ] && [ "$pidfile" ]; then
+-                      export PIDFILE="$pidfile"
+-                      set -- /lib/rc-scripts/makepid "$@"
+-              fi
+-
+               if [ "$fork" = "1" ]; then
++                      export PIDFILE="/dev/null"
++                      if [ "$makepid" ] && [ "$pidfile" ]; then
++                              export PIDFILE="$pidfile"
++                      fi
++                      set -- /lib/rc-scripts/makepid "$@"
+                       set -- /usr/bin/setsid "$@"
+               fi
+               if [ -n "$user" -a "$user" != "root" ]; then
+@@ -1009,7 +1008,7 @@ pidofproc() {
+       fi
+ 
+       # Next try "pidof" if pidfile is not specified
+-      if [ -z "$pid" ] && [ -z "$pidfile" ]; then
++      if [ -z "$pid" ] && [ -z "$2" ]; then
+               pid=$(pidof -o $$ -o $PPID -o %PPID -x "$1")
+       fi
+ 
+commit bf42a4fb7c71c31954499bf9cbce4548305afe80
 Author: Arkadiusz Miśkiewicz <arekm@maven.pl>
-Date:   Thu Jul 9 09:18:37 2015 +0200
+Date:   Tue Jun 7 17:09:48 2016 +0200
 
-    Make DELAY_LOGIN checks consistent with the one in rc.sysinit (broken in 277e5f5352e622c4317852cded63e2a287506655).
+    Mount /run as mode=0755,noexec,nosuid,nodev.
 
-diff --git a/rc.d/init.d/allowlogin b/rc.d/init.d/allowlogin
-index dcd789e..d837189 100755
---- a/rc.d/init.d/allowlogin
-+++ b/rc.d/init.d/allowlogin
-@@ -24,14 +24,14 @@ esac
- . /etc/rc.d/init.d/functions
+diff --git a/rc.d/rc.sysinit b/rc.d/rc.sysinit
+index f7f0eea..99bb078 100755
+--- a/rc.d/rc.sysinit
++++ b/rc.d/rc.sysinit
+@@ -409,7 +409,7 @@ if ! is_yes "$VSERVER" && [[ "$container" != lxc* ]]; then
+       parse_cmdline
  
- start() {
--      if is_yes "$DELAY_LOGIN" && [ -f /etc/nologin.boot ]; then
-+      if ! is_no "$DELAY_LOGIN" && [ -f /etc/nologin.boot ]; then
-               run_cmd "Allowing users to login" rm -f /etc/nologin /etc/nologin.boot
+       if [ -d /run ]; then
+-              is_fsmounted tmpfs /run || mount -n -t tmpfs run /run
++              is_fsmounted tmpfs /run || mount -n -t tmpfs run /run -o mode=0755,noexec,nosuid,nodev
        fi
- }
  
- stop() {
-       # /etc/nologin when shutting down system
--      if is_yes "$DELAY_LOGIN" && [ ! -f /etc/nologin ]; then
-+      if ! is_no "$DELAY_LOGIN" && [ ! -f /etc/nologin ]; then
-               nls "System shutdown in progress\n" > /etc/nologin
-               chmod 644 /etc/nologin
-               cp -fp /etc/nologin /etc/nologin.boot
-@@ -39,7 +39,7 @@ stop() {
- }
+       # Early sysctls
+@@ -680,7 +680,7 @@ if ! is_yes "$VSERVER" && [[ "$container" != lxc* ]]; then
+               mount -f -t devtmpfs devtmpfs /dev 2> /dev/null
+       fi
+       if is_fsmounted tmpfs /run; then
+-              mount -f -t tmpfs run /run 2> /dev/null
++              mount -f -t tmpfs run /run -o mode=0755,noexec,nosuid,nodev 2> /dev/null
+       fi
  
- status() {
--      if is_yes "$DELAY_LOGIN"; then
-+      if ! is_no "$DELAY_LOGIN"; then
-               nls "Delay login is enabled"
-       else
-               nls "Delay login is not enabled"
+       if is_fsmounted usbfs /proc/bus/usb; then